6.2 Correctness of operation
6.3.2 System Code
The evaluations above were performed for a bare-metal system (application running on the processor without an operating system (OS)). While this setting is representative of ultra-low-power processors and a large segment of embedded systems [92, 93],4 use of an OS is common in several embedded application domains, as well as in more complex systems. Thus, we also evaluated bespoke design for our applications running on the processor with an OS (FreeRTOS [96]). Application analysis of system code for FreeRTOS reveals that 57% of gates are not exercisable by the OS, including the entire hardware multiplier. When our benchmarks are evaluated individually with FreeRTOS, 37% of gates are unused in the worst case, 49% on average. When running FreeRTOS together with all 15 benchmarks, 27% of gates are unused.
4 Many embedded processors provide bare-metal development toolchains [94, 95].
Chapter 7
Software-based Gate-level Information Flow Security
In this chapter we show how the hardware-software co-analysis proposed in Chapter 2 can be used to track information flow of an application at the gate-level of an ultra-low-power embedded microprocessor. As the internet of things progresses toward the internet of everything, higher connectedness implies more security attack vectors and a larger attack surface. In the last couple of years, reported IoT attacks include compro-mising baby monitors to enable unauthorized live feeds, interconnected cars to control a car in motion, smart watches and fitness trackers to steal private information and health data, power grids and steel mills to render them offline, and medical devices with detrimental, perhaps fatal, consequences on patients’ health. Consequently, security and privacy have become first order design concerns for IoT systems. However, IoT systems are often ill-protected, in spite of their critical security implications, due to their limited energy and area budget to spend on security.
Prior work on gate-level information flow tracking shows that information security guarantees can be provided through techniques that track information flows at the gate level, but unfortunately, such solutions rely on non-commodity, secure-by-design processors; the ultra-low power and area constraints of ULP systems may make such ap-proaches infeasible. However, we have observed that many of the architectural changes required in existing secure-by-design processors arise because prior works assume that
67
all software running on a system besides the kernel is completely unknown, in order to provide a security guarantee for all applications. Since the application running on a ULP system is often simple, we have introduced application-specific information flow tracking that takes all of a system’s software into consideration during security analysis, enabling gate-level information flow security guarantees for commodity systems, without the programmability, performance, and monetary costs of a specialized secure-by-design processor. Our software-based solution to gate-level information flow tracking identifies all possible insecure information flows for the software running on a system, as well as the instructions that can cause violations, and allows security vulnerabilities to be eliminated through software modifications. By targeting only the vulnerabilities that an application is susceptible to, we minimize, and in some cases completely eliminate, the overhead of guaranteeing security for ULP systems.
7.1 Information Flow Security
Information flow security aims to (1) determine if any information flows exist from one state element (e.g., a variable in a program) to another state element and to (2) prevent or warn users of such flows when a flow violates an information flow policy. Past work [97, 98, 99, 100, 101, 102] has performed information-flow tracking at the software level and demonstrated its effectiveness at detecting a set of security vulnerabilities without modification of the hardware (i.e., applicable on commodity hardware). Other work [103, 104, 105, 106] proposes hardware modifications for improved efficiency and accu-racy of ISA-level information flow tracking. Unfortunately, these approaches not only require hardware modifications, but they may still miss information flows that crop up as a result of the low-level implementation details of a processor [107]. Our approach aims to achieve the advantages of both software-based and hardware-based information flow tracking – applicability to unmodified commodity hardware, accuracy in tracking information flows, and minimal runtime overhead – without the corresponding limita-tions.
In order to track all forms of digital information flow, Tiwari et al. [107] proposed gate-level information flow tracking (GLIFT). As shown in Figure 7.1, GLIFT augments
69
Figure 7.1: Example truth table for gate-level information flow tracking of a NAND gate. A ‘1’ in the taint value columns (shaded gray) represents a tainted value (e.g., untrusted or secret values).
each gate in a design with taint-tracking hardware. The taint of a gate’s output is determined by the values and taints of its inputs.By propagating taint values through each gate, tainted data (e.g., untrusted or secret) can be tracked from input ports (or other marked data, including instructions in program memory) through the processor at the gate level to guarantee that no tainted data reaches an output port that should remain untainted (e.g., a trusted or non-secret output). When fabricated with the base design, GLIFT can dynamically track taints at a high degree of accuracy, albeit at up to a 3× overhead in hardware. More recently, GLIFT has been used to statically track information flows [108]. In this work, an analysis called *-logic is used to statically track taints for a microkernel with no non-determinism running on hardware designed to be easily verifiable. The focus was on performing gate-level information flow tracking for a specific, application-agnostic secure-by-design system. We focus, instead, on performing application-specific gate-level information flow tracking for arbitrary IoT applications on commodity hardware, including applications with control dependencies on unknown, tainted inputs. When analyzed with *-logic, such applications could unnecessarily taint all software-exercisable gates
Based on the insights and verification of GLIFT, several secure-by-design processors
have been built. They range from a predication-based, non-Turing-complete proces-sor [107] to procesproces-sors that can handle arbitrary computations through hardware com-partmentalization [109, 108]. While these processors can guarantee that any software that runs on them cannot violate a non-interference information security policy (i.e., no untrusted inputs can affect trusted outputs and no secret inputs can affect non-secret outputs), they can be limited in their programmability (e.g., [107] requires all loops to be statically bounded while [109] does not naturally support unbounded or variable-length operations) and require hardware modifications (e.g., partitioned memory structures and memory bounds checking hardware). The cost of any re-design of a commodity microcontroller may be prohibitive. In this paper, we design full systems that ensure the same non-interference policy as [108] (i.e., no untrusted input can affect a trusted output and no secret input can affect a non-secret output), but on a per-application basis.
Recently, a body of work has emerged on developing hardware description languages and tools to design and verify information flow secure hardware [110, 111, 112, 113].
While such works can prove that a hardware design meets an information flow security policy, even one that is commercial, such as ARM’s Trustzone [113], these approaches cannot verify commodity hardware that does not already implement information flow security. Our approach targets commodity hardware, in addition to emerging hardware, and allows application developers to demonstrate the security of their applications at a fine-grained level.